MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5bc74bcee96164cc5419a48594d9aade1ebc15c2dd2544e9caa68c4fc715ed1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	b5bc74bcee96164cc5419a48594d9aade1ebc15c2dd2544e9caa68c4fc715ed1
SHA3-384 hash:	3397aabb32c38df26bb3e3208e9e38a06aaf7bfb1c024542d99609e666a6c57b8645bd1d9950866e49420cdbecb4c629
SHA1 hash:	e64c7bc5390441c90074e4dfc654ce8175b6b725
MD5 hash:	7d003801d29be4e7d744e37a1f1b9b74
humanhash:	twenty-lake-king-neptune
File name:	gunzipped
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	951'296 bytes
First seen:	2020-11-09 15:32:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	24576:VVeFhZOC8vzzfXE5m1HTeGDRD4o+B/Ql88:VyZOp3fU5m16Ex45/I88
Threatray	545 similar samples on MalwareBazaar
TLSH	E115E01223E97FA1E03E97798825100187F5EA1BE736D7DDBE9C00DA0B57F445B62B0A
Reporter	abuse_ch
Tags:	DHL MassLogger

abuse_ch

Malspam distributing MassLogger:

From: DHL Express <jessica_dhl@gmail.com>
Subject: Failed DHL Delivery Notification.
Attachment: Delivery Note - AWD 200038485852- 2349203968876.gz (contains "gunzipped")

MassLogger FTP exfil server:
ftp.scopertescientifiche.com:21

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

DNS request

Sending an HTTP GET request

Launching a process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/526812

Signature

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AntiVM_3

Yara detected Costura Assembly Loader

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5bc74bcee96164cc5419a48594d9aade1ebc15c2dd2544e9caa68c4fc715ed1/

Threat name:

Win32.Trojan.Ymacco

Status:

Malicious

First seen:

2020-11-09 08:49:00 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ww6hjphosylezrkbtjefstm2vxq6xqk4fxjfitu4vjumj7drl3iq._file

Verdict:

malicious

Label(s):

masslogger

MassLogger

116ea34f9e2aba532b39a48d0612f43632afea0039478a6d522e5f9c66141c1b

MassLogger

2fea8f7c727460dfd943dce7f9bb051f188f37a0150a132039a1892f18749ff3

MassLogger

70caf501b061da2729d33d4b0c5e9b9c58bc554cdbdddef16f7e057ea346808c

MassLogger

9a4a5ec81b23f16da34b34d5c368c71c085143be5e37b0567e0ddfc62d1f98a5

MassLogger

a2b0e9c1ea03a3a538fe9ef7f8e6dbf4c08feba8560e238e29fce0dd2f2e144b

MassLogger

bb9ec2242aca5dd16dd7fdebabc0550420bb3131b102bb5f5b781b409473b079

MassLogger

c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85

MassLogger

c62984587e756c3238bf4694ed959c509341427c9f06fc4973c0e7f6fb614546

MassLogger

dc241ba360d33151f9653cfc416e88c6637d91c097406965809860a5317b76e6

MassLogger

+ 535 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger spyware stealer

Link:

https://tria.ge/reports/201109-dy5cxlfh4s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

MassLogger

MassLogger Main Payload

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b5bc74bcee96164cc5419a48594d9aade1ebc15c2dd2544e9caa68c4fc715ed1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	masslogger_gcch Create hunting rule
Author:	govcert_ch

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf